The investigation of electrical brake systems is part of the development of modern brake technology. The hydraulic cylinder which in present-day systems presses the brake lining against the brake disc is replaced here, at each disc, by a highly efficient electric motor. The electric brake does not need any mechanical or hydraulic parts, as a vacuum brake power booster or a tandem master cylinder does. Moreover, the electric brake can take over other functions currently handled by a brake, and future ones as well, such as those of an anti-blocking system (ABS), a traction aid or anti-slip regulator (ASR), an electronic stability program (ESP), or an automatic intervention by the brakes such as can be provided for in distance-control systems.
One example for such a system is shown in WO 95/13946. This so-called electronic brake system displays a central module and another module allocated to the brake circuits or wheel component groups. The central module in this case can carry out ABS and ASR calculations, adjust the distribution of the braking force, and calculate the required brake pressure specifically for each wheel.
A micro-processor system is known from DE 195 29 434 A1 (P7959) in which two synchronized central units receive the same input information and handle it with the same programs on one or a number of chips. The two central units are connected via separate bus systems to the fixed-value and the write-read memories, and also to input and output units.
The bus systems are connected to one another by driver levels and bypasses which make it possible for the two central units jointly to read and process the data made available to them, including check-data and commands. This system makes it possible to save memory space. Only one of the two central units is connected to a full-scale fixed-value and a write-read memory, whilst the memory capacity of the second processor is limited to memory space for check-data, but access to all data is possible via the bypasses, so this means that both central units are each able to process the complete program.
In patent applications DE 197 16 197 A1 (P9009) and DE 197 20 618 A1 (P9018), micro-processor systems are described for regulating those aspects that are critical to safety and are equipped to process the one program with at least three central units, if possible all arranged on one chip. There are also fixed-value memories and write-read memories with additional memory spaces for check-data, input and output units, and comparison units which check the output signals from the central units to ensure that they tally. The central units are connected to one another via bus systems which make it possible for the central units to read and process the incoming data jointly, including the check-data and commands, on the basis of the same program.
The central units in this already familiar system are enlarged to make two complete control signal circuits and wired up in such a way that, if one fails, a majority decision enables the defective central unit to be recognized and an emergency function to be maintained.
Finally, a wiring arrangement is known from DE 197 17 686 A1 which is likewise suitable for a safety-critical control system and is constructed as two or more circuits, with each circuit containing a complete micro-processor system which processes the incoming data redundantly and supplies a fault-recognition signal if a fault or a deviation occurs between the data-processing results obtained redundantly. If a fault is recognized, the system switches over to an emergency function in which either the circuit is switch off or the actuators are handled by both the circuits of the intact micro-processor system. The two systems are provided with their own periphery, consisting of signal registration, actuator operation, and energy supply (7,8).
DE 195 10 525 A1 discloses a process for controlling or regulating the brake system of a motor vehicle in which a brake pedal actuation by the driver is registered by at least two measuring devices for two different values and by which the braking request of the driver is determined by means of the registered signals and changed into required values for wheel brakes and which controls or regulates the wheel brakes whereby the braking request of the driver is formed by at least two values independently from one another and is then further processed.
In the present invention, the basic objective is to create an electromechanical brake system and a procedure for controlling an electromechanical brake system, especially for motor vehicles, which is reliable but also inexpensive in construction and needs only limited expenditure of time and money in its installation.
The invention is based on the idea that, when a wiring arrangement of the type described above is used that is suitable for safety-critical regulation systems, designed with in-built redundancy, and capable of running in emergency mode, the operating safety required for a brake-by-wire system can also be guaranteed. It is possible to do without redundancy in the computer module that serves to control the individual wheel modules. Redundancy can then also be dispensed with for the bus systems that connect the control circuit(s) with the wheel modules. The state of the wheel module is monitored with at least one signal that provides information on the wheel rotation behavior, and in the event of a fault the wheel module can be transferred to the safe state via a switch-off path.
In this invention, an electromechanical brake system, especially for motor vehicles, can contain a pedal simulator for redundantly registering when the driver uses the brake pedal by means of a suitable sensor system. Also, a central module can be provided which calculates the desired braking value on the basis of output signals. In addition to this, at least one brake module can be provided to control at least one wheel brake, with the control being based on the desired braking value. In addition to this, a data transfer unit is provided which creates a data link between the central module and the brake module in which the central module can display a fault-recognition circuit capable of discovering a fault in the calculation of the desired braking value.
An important point is that the central module must be capable of running in emergency mode and can thus make a vital contribution to the required high level of operating safety of the system.
The central module can take higher functions into account in calculating the desired braking value, and can also display at least three redundant computers which calculate the desired braking value on the basis of the output signals from the sensor system. Higher functions of the brake system such as ABS, ASR, and ESP can also be implemented on at least two of these redundant computers in the central module.
According to this invention, the wheel brake modules and the wheel brakes can both function as individual systems with a simple interface and offer a low-costs total system. This applies particularly if the central module is integrated into the pedal simulator. Moreover, with the system architecture of this invention it is possible, without suffering any additional disadvantage such as increased cabling or reduced freedom from interference, to install a double or TT circuit division. The installation cost for the car manufacturer is minimal and the cabling cost only very slight. In addition to this, clear and simple interfaces are provided in the central module and the wheel modules to make the whole system easy to test and to reduce the complexity of communications between the individual modules. With short analog wiring and a highly efficient amplifier, fitted close to the actuator, a high level of active and passive suppression can be achieved. This invention also enables a very low level of "degradation"--loss of function--to be achieved in the event of a fault, and sensors make it impossible for safety-critical tension to affect one brake, whether the driver intends to brake or not, as a result of a fault in any one computer, the functional electronics, or the actuator.